The first hour after discovering a breach is when people make the decisions they most regret later. Someone reboots a compromised laptop “to be safe.” Someone else deletes the suspicious emails. A manager fires off a company-wide message speculating about what happened. Each instinct feels responsible in the moment, and each one can quietly destroy the evidence you’ll need to figure out what was actually exposed.
You don’t need to be a security expert to handle this hour well. You need a short list of priorities and the discipline to follow them while adrenaline is high. Here’s what to do, what to avoid, and why a clock you may not know about starts ticking the moment you discover the problem.
What Should You Do in the First Hour After a Data Breach?
In the first hour after a data breach, contain the problem without destroying evidence, get the right people involved (IT, leadership, legal counsel, and your insurer), and start documenting what happened. Just as important is what to avoid: wiping systems, paying anyone impulsively, or announcing anything publicly before you know what was exposed.
What Counts as a Data Breach?
A data breach is any incident where information is accessed, taken, or exposed by someone who shouldn’t have it. That includes more than dramatic hacks: a compromised email account, a lost or stolen laptop, a misdirected file, a cloud folder shared more widely than intended, or a breach at a vendor that holds your data. If you’re not sure whether an incident qualifies, treat it as one until you’ve learned otherwise. Investigating something that turns out to be minor costs far less than ignoring something that wasn’t.
What Should You Do in the First 10 Minutes?
The goal is to stop things from getting worse without wiping away the evidence.
- Disconnect affected devices from the network — unplug the cable or turn off Wi-Fi rather than powering the machine off or wiping it, since shutting down can erase information that shows what happened
- Change credentials for any account you believe is compromised — from a device you trust, not the suspect one
- Revoke access for anyone or anything that shouldn’t have it — a departed employee’s account, an unfamiliar connected device, or a forwarding rule you didn’t create
- Write down the time you first noticed — this detail matters more than it seems, as you’ll see below
Who Should You Call in the Next 10 to 20 Minutes?
Breach response is a team effort, and a few calls early on save a lot of trouble later:
- Your IT provider or security team — to guide containment and help determine what was touched
- The person with decision-making authority at your company — so someone owns the response and communications
- Legal counsel — breach notification rules are specific, and it’s far better to ask before acting than after
- Your cyber insurance carrier, if you have a policy — many policies require prompt notice and may have specific vendors or procedures you’re expected to follow, so check yours early rather than assuming
How Do You Preserve Evidence and Start a Timeline?
From roughly minute 20 to minute 40, shift into documentation mode. Take screenshots of anything unusual, including ransom notes, odd login alerts, and unexpected messages. Record who noticed what, when, and what actions have been taken by whom. Don’t delete suspicious emails or files, even if they seem like clutter. A simple running log, with timestamps, becomes extremely valuable later, both for investigators trying to understand what happened and for any legal or insurance process that follows.
How Do You Figure Out What Was Exposed?
In the last part of the hour, begin scoping the incident, even if you won’t have complete answers yet. What systems or accounts were involved? What kind of information lives there: customer details, employee records, payment data, health information? Roughly how many people might be affected, and where do they live? Your first answers will be incomplete, and that’s fine. The point is to start narrowing the question so your IT provider and legal counsel have something to work from.
Why Does the Clock Matter So Much in California?
Because the law now puts a hard deadline on notification. Under California Senate Bill 446, which took effect on January 1, 2026, a business that experiences a breach of unencrypted personal information generally must notify affected California residents within 30 calendar days of discovering the breach, with limited exceptions such as a law enforcement request or the time reasonably needed to determine the scope of the breach and restore the integrity of the system. If more than 500 California residents are affected, a sample notice must also go to the California Attorney General within 15 calendar days after residents are notified. You can read a law firm’s summary of the changes in Pillsbury’s overview of California’s new breach notification requirements.
This is general information, not legal advice, and how it applies to your situation depends on the facts. But it’s the reason your first-hour note of when you discovered the breach matters: that’s when the clock is generally understood to start.
What Should You Avoid Doing in the First Hour?
- Don’t wipe, reimage, or “clean up” affected systems before your IT provider or investigators have had a chance to preserve what they need
- Don’t delete emails, files, or logs, even ones that look like part of the problem
- Don’t pay a ransom or contact an attacker on impulse — payment raises legal and practical questions worth working through with counsel and your insurer first
- Don’t announce or speculate publicly — internal chatter and social posts made before you know the facts can create confusion and legal exposure
- Don’t assume it’s too small to matter — an apparently minor incident can still trigger notification obligations
What Might the First Hour Look Like in Practice?
Picture a 20-person business where the office manager notices that a shared cloud folder holding customer records was accessed from an unfamiliar location overnight. In one version of the hour, a well-meaning employee wipes and reinstalls the laptop used to log in, and deletes the alert emails to “tidy up,” which destroys the very logs needed to tell what was viewed. In the other version, the device is disconnected but left intact, the credentials are reset from a clean computer, IT and the insurer are called within twenty minutes, and a timestamped log records exactly when the problem was found. Both businesses had the same breach. Only one of them can answer the question every affected customer will ask: what exactly was exposed?
What Should You Have in Place Before It Ever Happens?
The first hour goes far better when the decisions were made before the crisis:
- A short, written incident response plan, even one page, naming who does what
- A contact list with phone numbers for your IT provider, legal counsel, and insurer
- Multi-factor authentication and monitoring that make a breach less likely and easier to spot
- Backups that are tested and kept separate from your main network
- A habit of knowing where your sensitive data actually lives
How SecureTECC Can Help
SecureTECC’s 24/7 Help Desk and Cybersecurity services mean a business has someone to call at the moment it matters, along with real-time threat monitoring that can catch problems earlier, and Backup & Data Recovery that supports getting back to normal operations afterward. To be clear about our role: we’re an IT and security provider, not a law firm or an insurance broker, so questions about notification obligations and policy coverage belong with your attorney and insurer. What we can do is help make sure your technical response is fast, careful, and well documented.
Frequently Asked Questions
Should I shut down all my computers right away?
Generally not. Disconnecting affected devices from the network contains the problem, while powering them off or wiping them can erase information investigators need. Follow your IT provider’s guidance on the specifics for your situation.
Do I have to notify my customers about a breach?
It depends on what data was involved, whose it was, and which laws apply. California generally requires notice to affected residents within 30 calendar days for breaches of unencrypted personal information, but whether your incident triggers that duty is a question for an attorney.
When should I contact my cyber insurance company?
As early as practical. Many policies require prompt notification and may specify which response vendors to use, so waiting or going out on your own can complicate a claim. Check your policy for its specific requirements.
Should I report a breach to law enforcement?
For cybercrime such as fraud, extortion, or ransomware, reporting to the FBI’s Internet Crime Complaint Center (IC3) is a common step, and it matters most when money was lost. Your attorney or insurer can advise on timing and any related obligations.
What if I’m not sure it’s actually a breach?
Treat it as a potential breach until you know otherwise. Starting containment and documentation early costs little, while waiting to be certain can let a small problem grow or erode the evidence you’d need.
The Bottom Line
You can’t undo a breach, but the first hour largely determines how well you understand it, how much it costs, and whether you meet your obligations afterward. Contain it without destroying evidence, call the right people, write everything down, and resist the urge to clean up or speak before you know the facts.
Wondering whether your business could handle that first hour if it started today? Book a free consultation with SecureTECC Solutions and we’ll walk through your readiness together — no pressure, no obligation.
